REMARKS 

The Office Action dated August 5, 2004 has been received and carefully noted. 
The above amendments to the claims, and the following remarks, are submitted as a full 
and complete response thereto. 

Claims 1, 11 and 14 are amended to more particularly point out and distinctly 
claim the subject matter of the invention. No new matter is added. Thus, claims 1-14 are 
presently pending in the application and are respectfully submitted for consideration. 

Claims 1-8, 11 and 14 were rejected under 35 U.S.C. §112, second paragraph, as 
allegedly being indefinite. Applicant amends the claims to more particularly point out 
and distinctly claim the subject matter of the invention. Applicant submits that the 
claims, as amended, in compliance with U.S. patent practice, and respectfully requests 
that the indefiniteness rejection of claims 1-8, 1 1 and 14 be withdrawn. 

Claims 1-6 and 9-11 were rejected under 35 U.S.C. §103(a) as allegedly being 
obvious over applicant's admitted prior art (AAPA) in view of U.S. Patent No. 5,649,095 
{Cozzd). The Office Action took the position that the AAPA taught all the features of 
independent claim 1 except that the second node identifies through the first node one or 
more portions of the electronic file required by the virus scanning application. The 
Office Action then alleged that Cozza provided those features of claim 1 missing from the 
AAPA. Applicant respectfully traverses and submits that the cited references, either 
alone or in combination, do not disclose or suggest all the features of any of the presently 
pending claims. 
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Claim 1, upon which claims 2-6 are dependent, recites a method of scanning 
electronic files for computer viruses. The method includes identifying at a first node of a 
computer network, electronic files which require to be scanned for computer viruses. 
The method also includes initiating a dialogue between the first node and a second node 
of the network. A second node includes a virus scanning application, during which 
dialogue the second node identifies to the first node one or more portions of the 
electronic file required by the virus scanning application. The method also includes 
transferring the identified portions firom the first node to the second node over the 
network. The method also includes, at the second node, scanning the transferred portions 
for computer viruses. 

Claim 9 recites an anti-virus scanning system for use in scanning electronic files in 
a computer network. The system includes a first computer having processing means 
arranged to identify electronic files which should be scanned for computer viruses. The 
system also includes a second computer having processing means arranged to perform a 
virus scanning operation. The first computer further includes communication means for 
initiating a dialogue between the first computer and the second computer, during which 
the second computer identifies to the first computer those portions of the electronic files 
required by the first computer for performing the virus scanning operation, and for 
transferring those portions to the second computer. 

Claim 10 recites a computer memory encoded with executable instructions 
representing a computer program for causing a first computer connected to a computer 
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network to identify electronic files which require to be scanned for computer viruses. 
The computer memory encoded with the executable instructions also causes a first 
computer connected to the computer network to initiate a dialogue between the first 
computer and a second computer also connected to the computer network. The computer 
memory encoded with the executable instructions also causes the first computer 
connected to the computer network to receive from the second computer an identification 
of portions of the electronic file which are required for virus scanning of the electronic 
files at the second computer. The computer memory encoded with the executable 
instructions also causes the first computer connected to the computer network to transfer 
the identified portion from the first computer to the second computer. 

Claim 11 recites a computer memory encoded with executable instructions 
representing a computer program for causing a first computer connected to a computer 
network to receive a dialogue initiation request from a second computer also connected to 
the computer network concerning an electronic file identified by the second computer as 
requiring a virus scan. The computer memory encoded with the executable instructions 
also causes the first computer connected to the computer network to identify to the 
second computer those portions of the electronic file which are required by the first 
mentioned computer for performing a virus scanning operation at the first computer. The 
computer memory encoded with the executable instructions also causes the first computer 
connected to the computer network to receive the identified portions of the electronic file 
firom the second computer. 
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As discussed in the specification, examples of the present invention enable the 
identification by the second node to the first node of those portions of a file which are 
required by the second node to effectively scan the file for viruses. Thus, the intelligence 
required at the agent may be reduced. Scan rules change relatively frequently as new 
viruses and new file types appear. According to examples of the present invention, the 
scanning related intelligence located at the first node may rarely need updating. Most 
updates may be performed only at the server. As a single server is likely to service 
multiple agents, examples of the present invention reduce the maintenance overheads, as 
well as minimize maintenance related network traffic. Thus, due to the reduced size of 
the agents' software, examples of the present invention may be easily modified to run on 
many different operating systems, for example, Windows 98/2000/XP, Linux, and the 
like. In contrast, the server software is relatively large and complex. It is respectfully 
submitted that the cited references, either alone or in combination, fail to disclose or 
suggest the elements of any of the presently pending claims. Therefore, the cited 
references fail to provide the critical and unobvious advantages discussed above. 

The AAPA relates to an F-Secure Server and Agent product. The product 
described in the AAPA describes the forwarding of whole files by the various agents to 
the server for scanning. The AAPA describes the server and agent product utilizing a 
sophisticated virus scanning engine located at the server. This process relied upon a 
predefined set of rules, or heuristics, to determine whether or not a file was infected. For 
example, the AAPA describes a rule such as "is the file type one of a number of file types 
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which are susceptible to infection?" If so, the AAPA describes scanning some portion of 
the file. The AAPA, however, does not disclose or suggest the features of identifying at a 
first node of the computer network, electronic files which require to be scanned for 
computer viruses. 

Cozza relates to a method and apparatus for detecting computer viruses through 
the use of a scanned information cache. Cozza describes scanning files for computer 
viruses that use the length of at least one portion of a file. During a scan, the current size 
of the file portion is compared to the length stored in a cache, and if there is a size 
difference, the file is then scanned for viruses that can change that portion of the size of 
the file. Referring to Figure 2 of Cozza, information concerning the current state of files 
23 on volumes 22 is stored in RAM 24, and information concerning prior states is stored 
in the scanned information cache. Each volume 22 with its files, or any subset, stored in 
the memory system is scanned. The volume being scanned is examined for the scanned 
information cache in step 32, which is located at a predetermined place on the volume 
being scanned or on some other accessible volume. If the scanned information cache file 
is found, it is read into RAM of some other high-speed memory in step 34. Cozza 
describes determining how the identifying information stored in the scanned information 
cache differs from the current state information thereby indicating a presence or absence 
of computer viruses. Cozza also describes scanning the file for the subsets of computer 
viruses of a type of computer viruses that are determined to be present. Cozza, however. 
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does not disclose or suggest the feature of identifying that a first node of a computer 
network, electronic files which require to be scanned for computer viruses. 

In contrast, present claim 1 recites "identifying at a first node of a computer 
network, electronic files which require to be scanned for computer viruses" and 
"transferring the identified portions fi-om the first node to the second node over the 
network." Claim 9 recites the patentable features of claim 1, but is drawn to an anti-virus 
scanning system. Claims 10 and 11 recite the patentable features of claim 1, but are 
drawn to a computer memory encoded with executable instructions representing a 
computer program. Applicant submits that the cited prior art, either alone or in 
combination, do not disclose or suggest at least these features of the presently pending 
claims. 

As stated in the Office Action, the AAPA does not disclose or suggest that the 
second node identifies with the first node one or more portions of the electronic file 
required by the virus scanning application. Applicant submits that Cozza does not 
disclose or suggest at least this feature missing from the AAPA. Cozza describes setting 
out a set of rules that might be implemented at the server. Cozza describes implementing 
a scanning engine at a server. Cozza compares the current size of a file portion to a 
length stored in the cache. Cozza does not disclose or suggest identifying file portions to 
be scanned at a first node and then transferring the identified portions fi-om a first node to 
a second node to be scanned for computer viruses. Applicant submits that Cozza does not 
disclose or suggest identifying any files in one node of a network that have been 



transferred to another node for scanning. Thus, Cozza does not disclose or suggest 
identifying at a first node of the computer network, electronic files which require to be 
scanned for computer viruses. For example, the scanning engine of Cozza does not 
disclose or suggest identifying, at a first node of a computer network, electronic files 
which are to be scanned for computer viruses. Thus, applicant respectfully submits that 
the cited references, either alone or in combination, do not disclose or suggest all the 
features of any of the presently pending claims. 

Applicant also submits that the combination of the AAPA and Cozza does not 
disclose or suggest all the features of the presently pending claims and that their 
combination teaches away from the claims. Applicant submits the proposed combination 
of the references would not result in a system in which the server has sufficient 
intelligence to identify relevant portions of a file and to transmit these portions to the 
server for scanning. In particular, referring to the Abstract of Cozza, an agent transmits 
portions of a file to the server, together with some cached portion size values. The server 
determines the actual sizes of the portions and scans the portions only if the actual sizes 
differ from the cached sizes. Thus, a transfer of a minimum amount of data may not be 
realized. Further, the proposed combination would require the implementation of a 
significant intelligence at the agents. Each time a new scanning rule was to be 
introduced, or a new file type created, the intelligence at the agent would need to be 
updated. A prior art reference must be considered in its entirety, i.e., as a whole, 
including portions that would lead away from the claimed invention. MPEP 2141.02. As 
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noted above, scanning rules change frequently as new viruses and file types appear. 
Applicant submits a combination of the cited references would result in numerous 
updates with an increased burden on the agents and server. Thus, the combination of the 
references does not disclose or suggest all the features of the presently pending claims, 
and that the proposed combination would lead away from the presently pending claims. 

Applicants also submit that the Office Action fails to provide any evidence of a 
motivation or suggestion to combine reference teachings, either in the references 
themselves or in the knowledge generally available to one of ordinary skill in the art, to 
combine the references to achieve applicant's invention. For example, Cozza describes 
using a scanned information cache to detect computer viruses. Applicant submits that 
Cozza does not disclose or suggest the transfer of volumes of data over a computer 
network. Applicant also submits that Cozza does not seek to reduce network traffic. 
Thus, applicant submits that one skilled in the art would not be motivated to modify 
Cozza for a gateway based solution to implement anti-virus applications running on a 
gateway that connects a network to the outside world, as discussed in the AAPA. 
Further, applicant submits that the Office Action does not provide any evidence how the 
scanning of files for computer viruses using the portion of a file of Cozza would reduce 
the transfer of the large volumes of data over a computer network, as acknowledged by 
the Office Action as being a disadvantage of the AAPA. Applicant also submits that the 
Office Action does not provide any evidence of a suggestion or motivation in the 
knowledge generally available to one skilled in the art to make the modification. The 
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mere fact that references can be combined or modified does not render the resultant 
combination obvious unless the prior art also suggests the desirability of the combination. 
MPEP 2143.01. Applicant respectfully submits that the Office Action has not provided 
any evidence of a motivation or suggestion to combine the references, either within the 
references themselves or in the knowledge generally available to one of ordinary skill in 
the art. 

For at least these reasons, applicant submits that claims 1-6 and 9-11 are not 
disclosed or suggested by the AAPA and Cozza, either alone or in combination. 
Applicant respectfully requests that the obviousness rejection of claims 1-6 and 9-11 be 
withdrawn. 

Claims 7, 8 and 12-14 were rejected under 35 U.S.C. §102(a) as allegedly being 
unpatentable over the AAPA and Cozza, and further in view of "common practice in the 
art." The Office Action took the position that the AAPA and Cozza taught all the 
features of claims 7, 8 and 12-14 except transferring from the second node to the first 
node data portions to be written into the file to disinfect the file. The Office Action then 
took Official Notice that it is common practice in the art of disinfecting computer virus to 
discard an unwanted file. Applicant respectfully submits that the cited references and the 
alleged Official Notice, either alone or in combination, do not disclose or suggest all the 
features of any of the presently pending claims. 

Claims 7 and 8 depend indirectly from claim 1. Claim 1 is summarized above. 
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Claim 12, upon which claims 13 and 14 are dependent, recites a method of 
disinfecting an electronic file stored at a first node of a computer network, after the file 
has been identified as containing a virus by a virus scanning engine located at a second 
network node. The method includes sending from the second node to the first node, data 
portions to be written into the infected file and/or instructions for disinfecting the file. 
The method also includes receiving the data portions and/or instructions at the first node 
and routing the data portions into the infected file and/or carrying out the instructions. 

Applicant respectfully submits that the Official Notice alleged by the Office 
Action is improper. Applicant submits that the Office Action does not provide sufficient 
evidence to support the conclusion of common knowledge in the art. Applicant further 
submits that the Office Action has not cited a prior art reference where the facts asserted 
to be well known are capable of instant and unquestionable demonstration as being well- 
known. See MPEP 2144.03. Assertions of specific knowledge of the prior art must 
always be supported by citation to some reference work recognized as standard in the 
pertinent art. In re Ahlert . 424 F.2d 1088, 1091 (CCPA 1970). As discussed in Ahlert, 
Official Notice unsupported by documentary evidence should only be taken by the 
examiner where the facts asserted to be well-known, or to be common knowledge in the 
art, are capable of instant and unquestionable demonstration as being well-known. 
Applicant submits that the alleged Official Notice is not capable of instant and 
unquestionable demonstration of being well-known, and that documentary evidence 
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should be provided to support the Official Notice. Applicant submits that the alleged 
Official Notice is improper, at least for these reasons. 

Further, even if disinfecting is considered common knowledge in the art, which 
applicant does not admit, the reliance on such by the Office Action still does not disclose 
or suggest all the features of any of the presently pending claims. As noted above, claim 
1 recites "identifying at a first node of a computer the electronic files which require to be 
scanned for computer viruses" and "transferring the identified portions fi-om the first node 
to the second node over the network." Claim 12 recites "after the file has been identified 
as containing a virus by a virus scanning engine located at a second network node" and 
"sending from the second node to the first node, data portions to be written into the 
infected file and/or instructions for disinfecting the file." Applicant submits that the cited 
references, even when considered with the alleged common practice in the art, do not 
disclose or suggest at least these features of the presently pending claims. 

As discussed above, the AAPA and Cozza, either alone or in combination, do not 
disclose or suggest identifying at a first network node of the computer network, electronic 
files which require to be scanned for computer viruses. Applicant further submits that the 
alleged common practice in the art does not disclose or suggest those features missing 
from claim 1 . For example, disinfecting computer viruses to discard an unwanted file 
does not disclosed or suggest identifying at a first node of a computer network electronic 
files which require to be scanned for computer viruses and transferring the identified 
portions from the first node to the second node over the network. With regard to claim 
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12, the same patentable features of claim 1 are recited. Thus, claims 12-14 are not 
disclosed or suggested at least for the reasons given above. Applicant submits that the 
cited references, even when combined with the alleged common practice in the art, does 
not disclosed or suggest all the features of any of the presently pending claims. 
Moreover, claims 7, 8 and 13-14 are dependent claims that recited additional patentable 
subject in conjunction with the independent claims. Applicant respectfully requests that 
the obviousness rejection of claims 7, 8 and 12-14 be withdrawn. 

It is further submitted that each of claims 1-14 recites subject matter that is neither 
disclosed nor suggested by the cited references, either alone or in combination. It is 
therefore respectfully requested that all of claims 1-14 be allowed, and this application 
passed to issue. 

If for any reason the Examiner determines that the application is not now in 
condition for allowance, it is respectfully requested that the Examiner contact, by 
telephone, the applicant's undersigned attorney at the indicated telephone number to 
arrange for an interview to expedite the disposition of this application. 
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In the event this paper is not being timely filed, the applicant respectfully petitions 
for an appropriate extension of time. Any fees for such an extension together with any 
additional fees may be charged to Counsel's Deposit Account 50-2222. 
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